Programs that map out a network to figure out which computers and services are available to be exploited.

learn more… | top users | synonyms

3
votes
2answers
7k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
2
votes
1answer
128 views

Network abnormally slow during night hours

My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
-2
votes
3answers
4k views

Which tool (apart from nmap) can I use to scan a range of IPv6 addresses? [closed]

When I try to use nmap: # nmap -sP -6 FE80::1-234 [...] Failed to resolve given IPv6 hostname/IP: FE80::1-234. Note that you can't use '/mask' or '[1-4,7,100-]' style ranges for IPv6.[...] What ...
3
votes
1answer
1k views

How does OS detection work in practice?

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them. But what kind of probes would distinguish a ...
0
votes
3answers
6k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
1
vote
3answers
1k views

How to find the OS of the target machine

I am new to this field. Currently I am using Linux OS and my question is how can I find the OS of another machine to which I do not have a direct access. I am interested in any possibilities which ...
7
votes
2answers
398 views

What should a Vulnerability Management System scan on a large scale

On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples? I ...
6
votes
2answers
4k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
-1
votes
1answer
5k views

How to know all the Connected devices to my Access Point including Phones [closed]

I need to list all the connected devices in my AP wireless network including mobile phones, also if it possible to know more information about each device, I am using Windows 7 and my access point is ...
0
votes
3answers
537 views

How to rewrite config files using SNMP?

I scanned a router and found that the community string is public. The write access is also enabled. Now I want to change the configuration of the router. Can anybody tell me about tools and tutorials ...
9
votes
2answers
22k views

nmap scan shows ports are filtered but nessus scan shows no result

I'm performing an port scanning on a range of IPs on our remote site. I tried running nmap scan on that IP range and some of the IP result are shown as filtered When I perform a nessus scan on the ...
2
votes
1answer
3k views

Detected Port Scanning Attack in ESET Smart Security

I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please ...
2
votes
2answers
237 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
3
votes
2answers
739 views

Is it possible to trace fellow nodes on a DSL internet connection?

I'm not in my college campus right now. In campus we had private LAN. There my computer was directly connected to a gateway. Using subnet masks I used to find out fellow nodes on my subnet. There were ...
3
votes
4answers
339 views

What does a switched network protect us from? What does it not protect us from?

There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
3
votes
1answer
3k views

Scan for mobile phones?

I'd like to measure queuing time, similar to what they're doing in Finland. Instead of detecting bluetooth (which is disabled in most phones) I thought of detecting EDGE/3G. I'd like to log the ...
4
votes
4answers
1k views

Do these ports mean anything?

I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security. PORT STATE ...
14
votes
6answers
4k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
6
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
4
votes
6answers
1k views

Determining network topology from the outside

To what extent can an attacker generate a map of a network from outside of it? Are network scanning tools such as nmap the only means to do this? Otherwise what other types of tools or techniques ...
9
votes
2answers
2k views

Bypassing a reverse proxy/NAT

Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running. Given that many ...
1
vote
2answers
1k views

TCP / UDP port monitoring programs for mac?

Does anyone know of a free and effective port monitor for mac? Also, can a laymen, in relatively short order, learn to use such software to detect and thus prevent unauthorized remote access/control ...
6
votes
4answers
499 views

What kind of IT security applications do you guys run on your laptop/desktop? [closed]

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
8
votes
4answers
6k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
4
votes
3answers
260 views

packet sniffers and segments

Just curious why most packet sniffers are limited to their segment? is it the nature of a gateway to block the attempt outside a subnet? cheers
13
votes
3answers
4k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
9
votes
2answers
1k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
5
votes
4answers
1k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
25
votes
5answers
3k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
23
votes
3answers
10k views

What benefits does Nessus have over OpenVAS?

Nessus and OpenVAS appear to have fairly similar features. Why would you choose one over the other, besides the benefit of commercial support (which isn't available for Nessus Home Feed users ...
12
votes
4answers
703 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks Is the presence of wireless access points tested for by using a wireless analyzer at ...